6 matches found
CVE-2026-106472
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...
CVE-2026-106472 Server-side request forgery in the Prometheus data source resource API
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...
EUVD-2026-124571
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...
CVE-2026-106472
The Grafana Prometheus data source is vulnerable to a Server-side Request Forgery (SSRF) due to a missing path allowlist. The application passes the resource path provided by the caller directly to the configured Prometheus server without restriction. Consequently, a user with permissions to quer...
PT-2026-145891
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...
CVE-2026-106472: Grafana: Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server…
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...